OpenAI Quietly Open-Sourced Codex Security. Hacker News Noticed First.

TL;DR

OpenAI has open-sourced Codex Security: a CLI and TypeScript SDK, Apache-2.0 licensed, for finding, validating, and fixing security vulnerabilities in your code. Until now the vulnerability-hunting agent lived only in a web-based research preview; as of this week you can npm install @openai/codex-security, point it at a repo, and wire it into CI. The release was so quiet that a Hacker News thread surfaced the repo before OpenAI said a word, pulling 423 points and 133 comments in its first eight hours while the repo climbed past 2,400 stars. Early adopters love the engineering harness and wince at the token bill.

What actually shipped

The package is @openai/codex-security, and it does four things: scan a repository (or one scoped folder, useful in monorepos), review changes, track findings across runs, and verify that fixes actually fix. Run npx codex-security scan . interactively with a ChatGPT sign-in, or set OPENAI_API_KEY for headless CI runs. You need Node 22+ and Python 3.10+.

OpenAI confirmed the release on X only after the story broke: "We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here." The company got scooped on its own launch, by its own users, which is one way to run a disclosure process. It also stressed this is "an early release" that will evolve with feedback.

A seven-phase pipeline, not a grep

Per the official docs, every scan executes a structured seven-phase process: threat modeling, finding discovery, validation, impact analysis, detailed reporting, structural hardening, and finalization. The docs explicitly warn you to wait for the whole run rather than judging early candidates, because the validation and impact phases exist to kill the false positives the discovery phase dredged up.

Results land as structured artifacts: scan-manifest.json, findings.json, and coverage.json, built for piping into whatever tracks your security debt. Findings come with attack-path analysis: where the tainted input enters, how it reaches the sink, and why the severity rating is what it is.

The harness is the product

The most-agreed-with take in the HN thread is that the model is not the moat. As commenter knighthacker put it: "The scanner is the least interesting part... The harness around it is the product: dedup across runs, false-positive tracking, budget controls."

That findings-tracking layer is what separates a scanner you run once from one you live with. Think of the model as a metal detector and the harness as the person with the logbook: the detector beeps at everything, but the logbook remembers yesterday's bottle caps, so you only dig fresh pings. Without it, an AI scanner re-reports the same accepted risks on every run until someone stops running it.

Where this came from

Codex Security is not new; the open code is. The product launched March 7, 2026 as a research preview inside the web-based Codex platform for ChatGPT Pro, Enterprise, Business, and Edu customers, an evolution of OpenAI's earlier Aardvark vulnerability agent, as The Hacker News reported at the time. During its 30-day beta it scanned 1.2 million commits and surfaced 792 critical and 10,561 high-severity findings, and OpenAI says false-positive rates have since fallen by more than half across all repositories.

Open-sourcing the client under Apache-2.0 changes who can build on it. The prompts, phase logic, and orchestration that used to be locked inside a web app are now readable, forkable code, which several HN commenters flagged as the actual giveaway: skills and prompts as inspectable IP.

The bill, and other sharp edges

The scans are agentic, long-running, and priced accordingly: multiple commenters report single scans consuming a quarter to half of a weekly plan's usage. One early adopter, gregwebs, summarized the experience:

This tool looks great, but it ran for almost an hour then got interrupted. It drained half my weekly usage on a Pro plan.

Other reported sharp edges: sparse progress output during long runs, failed (and still billed) scans when the repository HEAD changes mid-run, and model guardrails occasionally refusing to explain the very vulnerability the scanner just found. The model located the bug, then declined to discuss it, which is a novel take on responsible disclosure. OpenAI says it is an early release and it is listening; budget caps exist in the harness, so set them before your first full-repo run.

The arms race you are now in the middle of

The shape of this launch should look familiar. Anthropic shipped its Claude Security plugin for Claude Code on July 22: also threat-model-first, also validation-heavy, also aimed at making a security review something an agent does continuously rather than something a consultant does annually. OpenAI answering within a week with an Apache-2.0 CLI and SDK means the AI security-tooling race now has two frontier labs shipping open, scriptable clients.

The open questions from the thread are the right ones for self-hosters: no local model support means your code ships to OpenAI's API for analysis, and data-privacy posture is whatever your OpenAI agreement says it is. If that is disqualifying for your repos, this release still matters, because the orchestration logic you would want to point at a local model is now public.

Key Takeaways

• OpenAI open-sourced the Codex Security CLI and TypeScript SDK (@openai/codex-security) under Apache-2.0, with repo scans, change review, findings tracking across runs, fix verification, and CI/CD integration.
• The release went out quietly; Hacker News found it before OpenAI announced it, and the thread hit 423 points and 133 comments in eight hours.
• Scans run a seven-phase pipeline (threat modeling through finalization) and emit structured JSON artifacts for automation.
• The product's March beta scanned 1.2 million commits in 30 days and surfaced 792 critical plus 10,561 high-severity findings.
• Early adopters report real costs: single scans eating 25-50% of a weekly plan's usage, so set budget caps before a full-repo run.
• With Anthropic's Claude Security plugin shipping July 22 and this a week later, both frontier labs now offer open, scriptable security-review agents.

Sources: openai/codex-security on GitHub, OpenAI on X, Hacker News discussion, OpenAI Codex Security docs, The Hacker News